@astram/guard 0.14.0 → 0.15.0

package/migrations/1710000000009-CreateRecordPermissionRule.cjs

@@ -25,10 +25,19 @@
  * drops the table. Run by the DDL account.
  */
 
-const SCHEMA = 'shield_authz';
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['0e28b8f4682dea265dbd399d153f29c3f42c80e826dbe8bc5cbd3319fbdc4db3'];
+
 const TS = 'TIMESTAMP(0) NOT NULL DEFAULT CURRENT_TIMESTAMP';
 
-async function up({ query }) {
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`record_permission_rule\` (
     rpr_uuid          VARCHAR(36)  NOT NULL,
     rpr_policy_uuid   VARCHAR(36)  NULL,             -- groups a guided policy's AND-composed condition-rows; NULL = legacy/unconditional single-row rule
@@ -49,8 +58,10 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`record_permission_rule\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000014-CreateRecordShare.cjs

@@ -19,10 +19,19 @@
  * account. No FK to `record_permission_rule` — the two tables are independent.
  */
 
-const SCHEMA = 'shield_authz';
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['434236fcd1ef4c73a419674ebd757ce889a25c39744acb4db365a93c5230a844'];
+
 const TS = 'TIMESTAMP(0) NOT NULL DEFAULT CURRENT_TIMESTAMP';
 
-async function up({ query }) {
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`record_share\` (
     rs_uuid          VARCHAR(36)  NOT NULL,
     rs_tenant_uuid   VARCHAR(36)  NOT NULL,        -- the tenant the shared record belongs to
@@ -42,8 +51,10 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`record_share\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000015-CreateScopeClosure.cjs

@@ -27,9 +27,17 @@
  * the Application schema).
  */
 
-const SCHEMA = 'shield_authz';
+const { frameworkSchemasForMigration } = require('@astram/core');
 
-async function up({ query }) {
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['91be11b8677118a50f8a786c967cc2643ab4d5db48b5847acb57560634ab4591'];
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`scope_closure\` (
     ancestor_uuid    VARCHAR(36) NOT NULL,   -- a node (company) in the hierarchy
     descendant_uuid  VARCHAR(36) NOT NULL,   -- a node at or below the ancestor (self = depth 0)
@@ -39,8 +47,10 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`scope_closure\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000016-AlterCompanyParentFkRestrict.cjs

@@ -21,14 +21,21 @@
  * timestamp); `...016` sorts strictly after `...001`, so `companies` + its FK already exist.
  */
 
-const SCHEMA = 'shield_app';
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['4af1a570fa1e9d161bcac25087866baf1a3783e88df06db40f0a91be4ee590b4'];
+
 const TABLE = 'companies';
 const FK = 'FK_companies_parent';
 const COL = 'c_parent_uuid';
 const PK = 'c_uuid';
 
 /** True if a FK constraint of this name exists on the table (idempotency guard). */
-async function fkExists(query) {
+async function fkExists(query, SCHEMA) {
   const rows = await query(
     `SELECT 1
        FROM information_schema.TABLE_CONSTRAINTS
@@ -42,15 +49,17 @@ async function fkExists(query) {
   return Array.isArray(rows) && rows.length > 0;
 }
 
-async function dropFkIfPresent(query) {
-  if (await fkExists(query)) {
+async function dropFkIfPresent(query, SCHEMA) {
+  if (await fkExists(query, SCHEMA)) {
     await query(`ALTER TABLE \`${SCHEMA}\`.\`${TABLE}\` DROP FOREIGN KEY \`${FK}\``);
   }
 }
 
-async function up({ query }) {
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   // Drop the existing SET NULL FK (if present), re-add it as RESTRICT.
-  await dropFkIfPresent(query);
+  await dropFkIfPresent(query, SCHEMA);
   await query(
     `ALTER TABLE \`${SCHEMA}\`.\`${TABLE}\`
        ADD CONSTRAINT \`${FK}\` FOREIGN KEY (\`${COL}\`)
@@ -58,9 +67,11 @@ async function up({ query }) {
   );
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   // Restore the original SET NULL behavior.
-  await dropFkIfPresent(query);
+  await dropFkIfPresent(query, SCHEMA);
   await query(
     `ALTER TABLE \`${SCHEMA}\`.\`${TABLE}\`
        ADD CONSTRAINT \`${FK}\` FOREIGN KEY (\`${COL}\`)
@@ -68,4 +79,4 @@ async function down({ query }) {
   );
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000017-CreateServiceAccountKey.cjs

@@ -15,9 +15,17 @@
  * `down` drops the table. Run by the DDL account.
  */
 
-const SCHEMA = 'shield_authz';
+const { frameworkSchemasForMigration } = require('@astram/core');
 
-async function up({ query }) {
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['8c591ca61982f183ba26fb2ce6df2f56068333713654ca1b1e27a70d5e6101e2'];
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`service_account_key\` (
     sak_account_id     VARCHAR(36)  NOT NULL,          -- the <accountId> inside the ask_ key (= service_account.sa_id)
     sak_version        INT          NOT NULL,          -- monotonic per account; rotation bumps it
@@ -34,8 +42,10 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).authz;
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`service_account_key\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.6.0",
-    "@astram/engine": "0.7.0"
+    "@astram/core": "1.7.0",
+    "@astram/engine": "0.8.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",